Binance Restarts Withdrawals as Questions Linger on Record Hack

Binance began restoring customer withdrawals Sunday after hackers attempted to drain over $6 billion in the biggest cyber theft ever recorded, as the crypto industry awaits answers on the breach blamed on North Korea and steps to strengthen the exchange’s defenses.The world’s largest digital-asset platform reopened Bitcoin withdrawals after 2 p.m. Singapore time, more than two days after halting them following the breach. The first phase is set to cover 15 tokens, including Ether and the two biggest stablecoins, Tether’s USDT and Circle Internet Group Inc.’s USDC, Binance said on X. “We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” Binance said. Read more: Binance’s $6.3 Billion Hack: How Crypto Insurance Works Withdrawals on 12 blockchain networks including Ethereum, BNB Smart Chain, XRP and Base resumed by around 7:30 p.m., according to the company. The restart tests Binance’s promise to make customers whole following a theft four times the size of the previous record crypto hack at Bybit in 2025. The US Federal Bureau of Investigation said on Saturday the Binance attack was carried out by TraderTraitor, an elite North Korean hacking unit it also held responsible for the roughly $1.5 billion Bybit theft. The market fallout appears relatively contained, with most major cryptocurrencies seeing a change of less than 1% Sunday. Bitcoin, which accounts for about 60% of the sector’s market value, was trading around $78,000, about 5% below its Thursday high before the attack. “On some level, this shows how much the industry has matured,” said Haseeb Qureshi, managing partner at venture fund Dragonfly. “We saw extraordinarily quick responses.” Binance said it has so far replaced about 90% of the stolen cryptocurrency using its corporate treasury, emergency funds and insurance funds. The funds drained in the attack were a mix of the largest cryptocurrencies across 10 blockchains, including Bitcoin and Ethereum. “Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds,” it said. “These losses will not be passed on to users.” The exchange is able to cover the losses as a result of its ongoing investment of revenue into cryptocurrencies, Binance co-Chief Executive Officer Richard Teng said in a video posted on social media on Friday. Yi He, who is co-CEO, said Binance’s revenue for this year would completely cover the amount lost. The ultimate cost to Binance remains unclear. The exchange said about $3 billion in affected assets had been frozen as of Friday, though that does not mean they have been recovered. Read more: Record Binance Hack Shows No Crypto Firm Is Too Big to Breach A spate of attacks this year on crypto firms and the broader financial industry has heightened concerns that artificial intelligence is making hackers more effective. Some security experts believe North Korean hackers have incorporated AI tools into their arsenal, helping especially with reconnaissance and social engineering. Along with the FBI, blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all pointed to hackers in North Korea as the culprits in the Binance attack. The attacks have exposed security weaknesses as the crypto industry pushes into mainstream finance. Hundreds of millions of dollars were drained from Bitget in September. Hackers also stole more than $100 million in Bitcoin from wallets secured by Coinkite Inc. devices, while tampering involving Ledger devices led to millions of dollars in losses. Other recent cyberattacks have hit prediction market Polymarket, South Korean financial firms Mirae Asset Global Investments and Daishin Securities, as well as Japanese currency trading platform GMO Internet Group Inc. Binance dwarfs its industry rivals. It holds roughly $134 billion in assets, compared with about $29 billion at the second-largest exchange OKX, according to DefiLlama data. Binance saw $2.5 billion in net outflows after resuming withdrawals, according to DefiLlama data as of 7:30 p.m. Singapore time. Yi and Teng on Friday confronted the potential reputational damage the attack could do. In a video posted on X, Yi promised Binance would continue to work with law enforcement to find the attackers. The company has vowed to reimburse any users who lost funds in the hack. “We won’t let the hackers take away the momentum this industry deserves,” she said in her video post, speaking in Mandarin. “Of course, there are areas where we could have done better. We should have invested more in security earlier, and set stricter standards. Going forward, we won’t hold back, whether it’s investing in security or fighting hackers.” Binance established an emergency reserve called the Secure Asset Fund for Users, or SAFU, in 2018 as a backstop for customers in “extreme situations,” according to the exchange. SAFU is generally maintained at around $1 billion, but has fluctuated in the past in tandem with market movements, Binance said in 2024. Binance said earlier that the incident may involve a compromised software engineer’s laptop, as well as “additional points of breach.” It found no evidence of leaked private keys, it said. Photograph: The Binance logo on a smartphone arranged in Gyeongsan, South Korea, on Friday, Oct. 30, 2026; photo credit:: SeongJoon Cho/Bloomberg Copyright 2026 Bloomberg. Topics Trends Cyber